Privacy Policy
This is the same policy shown inside the Vararuchi app (Settings → Privacy), published here for transparency. The in-app version is where you exercise data controls such as Export My Data and Delete My Account. See also the Terms of Service.
1. What data we collect
We collect data only necessary to provide the service:
- Identity: Name and email from Google Sign-In (OAuth). We never store your Google password.
- Learning data: Topics studied, quiz scores, flashcard progress, knowledge mastery sessions, career roadmap, language learning history, and AI response style preferences (goal, pace, verbosity).
- Usage data: Spark (credit) usage, feature access timestamps, subscription tier.
- Uploaded content: Documents, audio files, and images you submit for AI analysis. Files are deleted from our servers after indexing. Text representations (embeddings) derived from your content are stored in our vector database (Pinecone) to power the Knowledge Mastery search feature; these are deleted when you delete the source or delete your account.
- Payment data: Order IDs and payment confirmation from Razorpay. We never receive or store card numbers. Payment records are retained for 6 years as required by the GST Act, 2017.
- Student verification data: For users applying for the Student discount plan — academic email address, institution name, enrollment dates, and a photo of your student ID card. Collected only with your explicit consent during the verification flow, used solely to verify student status, and retained for a maximum of 1 year. You may request deletion at any time. Governed by the Digital Personal Data Protection Act, 2023.
- Community data: Help Center posts, replies, bug reports, and feature requests that you create. Publicly visible to other users.
- Consent records: Date and version of the Terms of Service and Privacy Policy you accepted, stored for audit purposes.
- Technical data: Browser type, device type, IP address (server logs retained 90 days), Firebase Analytics events (only if you accepted analytics cookies).
- App Check signals: reCAPTCHA v3 browser signals used by Firebase App Check to prevent automated abuse. Governed by Google's reCAPTCHA Privacy Policy.
2. Legal basis for processing (GDPR)
For users in the European Economic Area and UK, we process personal data under the following legal bases (GDPR Art. 6):
- Performance of contract (Art. 6(1)(b)): Processing necessary to provide the AI tutoring service, manage your subscription, and process payments.
- Consent (Art. 6(1)(a)): Analytics cookies and student verification data — you may withdraw consent at any time in Settings → Privacy.
- Legitimate interests (Art. 6(1)(f)): Security logging, abuse prevention, crash reporting, and service improvement through anonymised analytics.
- Legal obligation (Art. 6(1)(c)): Retaining payment records for 6 years under the GST Act, 2017.
3. How we use your data
- To deliver personalised AI tutoring and track learning progress.
- To process payments and manage subscription tiers.
- To prevent abuse and enforce usage limits (Sparks system).
- To improve the service through anonymised analytics (only with your consent).
- We do not sell, rent, or share your personal data with third parties for marketing.
- We do not use your learning data or uploaded content to train AI models.
4. Third-party services
We use the following sub-processors, each governed by their own privacy policies:
- Google Firebase — Authentication, Firestore database, file storage, hosting, and analytics
- Google Cloud Run — Serverless compute hosting for our backend API
- Vararuchi AI Engine — AI inference for all tutoring and learning responses (backed by third-party AI infrastructure providers under Data Processing Agreements)
- Pinecone — Vector database for Knowledge Mastery document search (RAG); hosted on AWS us-east-1
- Deepgram — Audio transcription for lecture and recording uploads
- Firecrawl — Web content extraction for URL-based knowledge ingestion
- Razorpay — Payment processing (PCI-DSS Level 1 compliant); we never receive card or bank details
- Upstash Redis — Rate-limiting cache; stores anonymised user ID and request count only
- Sentry — Crash reporting; error events are scrubbed of personally identifiable information before transmission. Sentry retains event data for 90 days.
All sub-processors are bound by Data Processing Agreements (DPAs) consistent with GDPR Art. 28 and DPDPA 2023 § 8. Cross-border transfers to processors outside India and the EU are governed by Standard Contractual Clauses (SCCs) or equivalent safeguards.
5. Data retention
- Your account data is retained until you delete your account.
- Uploaded files are deleted from our servers immediately after processing.
- Document embeddings (vectors) in Pinecone are deleted when you delete the source document or when you delete your account.
- Payment audit logs are retained for 6 years as required by the GST Act, 2017.
- Server access logs are retained for 90 days.
- Student verification photos are retained for up to 1 year from verification and then deleted.
- Community posts remain unless you delete them. Deleted posts are permanently removed.
6. Your rights (GDPR / DPDPA / CCPA)
Under applicable law (GDPR, DPDPA 2023, and CCPA), you have the right to:
- Access your personal data — use "Export My Data" in Settings → Privacy (complete JSON download from our servers).
- Rectify inaccurate data — contact us at admin@vararuchi.com.
- Erase your data — use "Delete My Account" in Settings → Privacy. This permanently deletes all learning data, uploaded content, vectors, and community posts. Note: payment records are retained for 6 years per GST Act, 2017.
- Portability — "Export My Data" in Settings provides your full personal data across all features in machine-readable JSON format.
- Restrict processing or object — email us and we will suspend processing within 7 days.
- Withdraw consent — change analytics cookie preferences at any time in Settings → Privacy → Cookie Preferences.
- Lodge a complaint — you have the right to lodge a complaint with your local data protection authority. In the EU: your national DPA (see edpb.europa.eu). In India: the Data Protection Board of India (when operational). In the UK: the Information Commissioner's Office (ico.org.uk).
California residents (CCPA): You have the right to know what data we collect, the right to delete it, and the right to opt out of sale (we do not sell data). We do not discriminate against users who exercise CCPA rights. Requests: admin@vararuchi.com (response within 45 days).
To exercise any right, email admin@vararuchi.com. We respond within 30 days (45 days for CCPA requests).
7. Cookies & local storage
We use:
- localStorage / IndexedDB (essential): Storing your learning sessions and preferences locally for offline access. Always active as these are required for the app to function.
- Firebase session cookies (essential): Managed by Firebase Authentication for secure sign-in. Always active.
- Analytics cookies (optional): Firebase Analytics usage events. Only activated if you click "Accept all cookies." You can change this preference any time in Settings → Privacy → Cookie Preferences.
- reCAPTCHA v3 (essential): Browser signals collected by Firebase App Check to prevent automated abuse of the service.
8. Security
All data is transmitted over HTTPS. Firestore and Firebase Storage are protected by server-enforced security rules (owner-only access). Sensitive operations (subscription upgrades, payment processing, account deletion) are performed exclusively server-side using Firebase Admin SDK. Rate limiting and MIME type validation protect upload endpoints.
In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware (GDPR Art. 33) and affected users without undue delay where the breach is likely to result in high risk (GDPR Art. 34). Under DPDPA 2023, we will notify the Data Protection Board as required by applicable rules.
9. Children's privacy
Vararuchi is intended for users aged 18 and above. We do not knowingly collect personal data from minors under 18 without verified parental consent. Users are required to confirm they are 18 or older (or that a parent/guardian is creating the account with parental consent) during sign-up.
If you believe a minor's data has been collected without proper consent, contact us at admin@vararuchi.com and we will delete the data within 72 hours.
10. Changes to this policy
We will notify users of material changes via in-app notification at least 14 days before the change takes effect. Continued use after the effective date constitutes acceptance.
Regional privacy addendums
California (CCPA / CPRA)
In addition to the rights above, California residents have the following additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
- Right to Know: Request disclosure of the categories and specific pieces of personal information collected about you, the categories of sources, and the business purposes for collection.
- Right to Delete: Request deletion of personal information we hold about you, subject to certain exceptions (e.g., payment records kept for legal compliance).
- Right to Correct: Request correction of inaccurate personal information. Contact admin@vararuchi.com with the correction requested.
- Right to Opt Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising. No action is required.
- Right to Limit Use of Sensitive Information: We only use sensitive personal information (student ID, academic email) for the purpose of verifying your student status. We do not use it to infer characteristics about you.
- Right to Non-Discrimination: We do not discriminate against you for exercising your CCPA/CPRA rights.
- Verified requests will be responded to within 45 days. To submit a request, email admin@vararuchi.com.
Canada (PIPEDA / Law 25 Quebec)
- Personal information is collected with your knowledge and consent, and only for the purposes described in this Privacy Policy.
- You may access or correct your personal information by contacting admin@vararuchi.com. We will respond within 30 days.
- Commercial electronic messages (if sent) comply with Canada's Anti-Spam Legislation (CASL). You may unsubscribe at any time via the link in any email we send.
- Privacy complaints may be directed to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
Australia (Australian Privacy Act 1988)
- We comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).
- You may request access to or correction of personal information held about you. Contact admin@vararuchi.com. We will respond within 30 days.
- If you are unsatisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.
- We do not transfer personal information outside Australia except to providers listed in our Privacy Policy, each of which provides equivalent data protection obligations.
Singapore (Personal Data Protection Act 2012)
- We comply with Singapore's Personal Data Protection Act 2012 (PDPA).
- You have the right to access and correct your personal data. Contact admin@vararuchi.com. We will respond within 30 days.
- Complaints may be directed to the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.
Brazil (Lei Geral de Proteção de Dados — LGPD)
- We comply with Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD), Law No. 13,709/2018.
- You have the right to confirm the existence of, access, correct, anonymize, block, delete, and port your personal data.
- The legal bases for processing your data are performance of contract (service delivery), consent (analytics cookies, student verification), and legal obligation (payment record retention).
- To exercise your rights or lodge a complaint, contact admin@vararuchi.com. Complaints may also be directed to the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd.